Last updated: October 22, 2026. This policy reflects the currently designed Outbox Social workflow and will be revised as services become available.
Authentication
Accounts require strong passwords, email confirmation, single-use recovery links and secure host-only session cookies. Passwords are hashed using PBKDF2.
Billing boundaries
Stripe-hosted checkout handles card entry. Our Worker receives subscription status through signed Stripe webhooks.
Credentials and integrations
API secrets belong in Cloudflare Worker secrets, not in public website source files. Authorized platform OAuth tokens should be stored privately and scoped.
Reporting a concern
Send suspected account or security problems to support@outboxsocial.com. Do not include passwords or private API keys.